Defense-in-depth method based on known device behavior

A system for identifying an unknown device on an Internet of Things (IoT) network, the system comprising one or more processors and memory storing computer-executable instructions that, when executed by the one or more processors, causes the system to:

• detect connection of an unknown device on the IoT network;
• determine an organizational unique identifier (OUI) from a media access control (MAC) address of the unknown device;
• determine a hostname from a DNS reverse lookup of the unknown device;
• retrieve a vendor identifier (ID) from an OUI database corresponding to the OUI;
• send a plurality of requests to the unknown device, wherein each request is sent to one of a plurality of transmission control protocol (TCP) ports of the unknown device, wherein sending the plurality of requests comprises generating TCP SYN probes as raw IP packets directed to a predefined set of TCP port numbers associated with IoT services, and monitoring for SYN-ACK and RST responses to populate a TCP port-state vector;
• receive a TCP port output comprising a corresponding response to each request made to a corresponding one of the plurality of TCP ports;
• send a plurality of user datagram protocol (UDP) datagrams to the unknown device, wherein each datagram is sent to one of a plurality of UDP ports of the unknown device, wherein sending the plurality of UDP datagrams comprises transmitting protocol-specific UDP payloads to elicit service-specific responses from DNS, SNMP, and DHCP services, and classifying responses and ICMP ‘port unreachable’ codes to populate a UDP port-state vector;
• receive a UDP port output comprising a corresponding response to each datagram sent to a corresponding one of the plurality of UDP ports;
• send a dynamic host configuration protocol (DHCP) deauthorization request to the unknown device;
• detect reconnection of the unknown device on the IoT network;
• collect and filter DHCP options and parameters (e.g., DHCP Hostname from Option 12) from the unknown device, including parsing a DHCP Option 55 Parameter Request List emitted during a DHCP discovery process;
• collect and filter DHCP option 55 parameters from the unknown device;
• determine from the vendor ID, the TCP port output, and the UDP port output a device fingerprint, wherein the device fingerprint comprises a tuple including:
• (i) the vendor ID mapped from the QUI, (ii) a TCP port-state vector comprising open/closed/filtered states per probed TCP port, and (iii) a UDP port-state vector comprising open/open|filtered/closed/filtered states per probed UDP port;
• determine a first identity of the unknown device based on matching the device fingerprint to parameters in an identity database, wherein determining the first identity comprises comparing the device-fingerprint tuple to entries in a structured centralized fingerprints/identity database;
• and
• refine the first identity to determine a second identity based on the DHCP option 55 parameters, wherein refining the first identity comprises correlating values in the collected DHCP Option 55 parameters with manufacturer- and model-specific parameter-request patterns stored in the identity database.